Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Carve email addresses enclosed in <>s #612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
seanthegeek wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Carve email addresses enclosed in <>s #612

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
133d926
Carve email addresses enclosed in <>s
Oct 1, 2015
9130d4e
Fix email regex
Oct 1, 2015
d8141dd
Move <> email carving from indicator handler to email handler
Oct 1, 2015
2b75b3d
Fix regex typo
Oct 1, 2015
5df0782
Update regex as suggested by @frbapolkosnik
Oct 2, 2015
ee65c86
Merge remote-tracking branch 'crits/master' into patch-1
Oct 21, 2015
453a895
Merge remote-tracking branch 'origin/patch-1' into patch-1
Oct 21, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions crits/emails/handlers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
import io
import sys
import olefile
import re

from dateutil.parser import parse as date_parser
from django.conf import settings
Expand Down Expand Up @@ -49,6 +50,8 @@
IndicatorThreatTypes
)

email_regex = re.compile(b'<(.+@.+)>')

def create_email_field_dict(field_name,
field_type,
field_value,
Expand Down Expand Up @@ -1305,6 +1308,11 @@ def create_indicator_from_header_field(email, header_field, ind_type,
}
return result

if '@' in value:
email_regex_results = email_regex.findall(value)
if len(email_regex_results) == 1:
value = email_regex_results[0]

newindicator = handle_indicator_ind(value,
email.source,
ind_type,
Expand Down